Forticlients not updating

[#1]

I know it may seem like this is the wrong forum topic, but it is a protection profile on a forti60 that is not allowing the updates. The forticlient says network error, but when I apply a firewall policy to one of the FDN IP' s with no protection profile it updates fine. I am running a forti60 with build#319. I am 99% sure it is the web filtering section because we had this issue before. When it was on a later build (i downgraded due to the known memory issues) and the web filter section was referencing a url filter list that was empty. We removed this and it solved the issue. Now this version doesn' t allow for multiple url filter lists and I had it unchecked entirely, and we had it working fine now it is failing again. Anyone else see this? It is completely embarrassing that to our customer that the fortigate is blocking the forticlient from updating, it makes fortinet look really bad.

[#2]

Just to add, I have isolated the problem. The protection profile' s A/V scanning on http is doing it, i know the forticlients update via port 80 so after turning off the web filtering didn' t work I tried the A/V and it works when I turn it off. I assume this is a comfort clients setting, as it is not getting a response so it reports network error. However, I have set it with no comfort clients, at 10 and 10240, 1 and 10240, and 1 and 600, and none have helped. I could tweak this until the cows come home before I get the right setting. If anyone has dealt with this and found a good setting let me know!

[player]

my Comfort Clients settings are working great with 1/10240

[#4]

Ok, A/V hoses it and no comfort clients setting I have tried works. If i have either file pattern or scanning on it kills it. Does anyone have a list of fortinet update IP' s and I will just make a policy allowing it for now. I need to get this fixed asap, this is embarrassing.

[player]

use those : 65.39.139.0 255.255.255.0 64.69.90.228 255.255.255.255

[#6]

Thanks a million. I am going to open a support case but at least I can get this fixed in the short term. I will let you know what I find.

[#7]

I think I found the issue. The memory utilization was at aour 75 to 76% which is in the yellow. I tweaked the logging and got it down to 70% and it is working with 1/10240 on the comfort clients.

[#8]

Ok, memory is backup to 76% and it is still working fine, so i don' t know what is up, but it is working. I didn' t think that 76% was all that high anyway, should I be concerned at that level. I know I should know this from my fcnsp training, but i don' t. I know A/V has issues at 80% and updates will fail at that level, but at the mid 70' s is there an issue?

[#9]

Hi, I dont think that the system memory is represented in the Fortigate GUI. It is my understanding that to get the true memory usage you have to use a different command in the CLI. - diag hardware sysinfo shm I have had similiar problem with forticlient updates for the first update but using the override server with the ip address for forticlient.fortigate.net solved it. Not sure if this will help you in your case though. Kind Regards, Aidan